{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8452","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8452/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8452/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8452/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/8452","id":231234089,"number":8452,"title":"Improve fingerprinting of SMB endpoints via native_lm + recog","user":{"login":"jhart-r7","id":3869433,"avatar_url":"https://avatars1.githubusercontent.com/u/3869433?v=3","gravatar_id":"","url":"https://api.github.com/users/jhart-r7","html_url":"https://github.com/jhart-r7","followers_url":"https://api.github.com/users/jhart-r7/followers","following_url":"https://api.github.com/users/jhart-r7/following{/other_user}","gists_url":"https://api.github.com/users/jhart-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jhart-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhart-r7/subscriptions","organizations_url":"https://api.github.com/users/jhart-r7/orgs","repos_url":"https://api.github.com/users/jhart-r7/repos","events_url":"https://api.github.com/users/jhart-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jhart-r7/received_events","type":"User","site_admin":false},"labels":[{"id":109040766,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/delayed","name":"delayed","color":"F5A9A9","default":false},{"id":213102939,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/enhancement","name":"enhancement","color":"5319e7","default":true},{"id":103436071,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/library","name":"library","color":"fad8c7","default":false}],"state":"open","locked":false,"assignee":{"login":"egypt","id":287967,"avatar_url":"https://avatars2.githubusercontent.com/u/287967?v=3","gravatar_id":"","url":"https://api.github.com/users/egypt","html_url":"https://github.com/egypt","followers_url":"https://api.github.com/users/egypt/followers","following_url":"https://api.github.com/users/egypt/following{/other_user}","gists_url":"https://api.github.com/users/egypt/gists{/gist_id}","starred_url":"https://api.github.com/users/egypt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/egypt/subscriptions","organizations_url":"https://api.github.com/users/egypt/orgs","repos_url":"https://api.github.com/users/egypt/repos","events_url":"https://api.github.com/users/egypt/events{/privacy}","received_events_url":"https://api.github.com/users/egypt/received_events","type":"User","site_admin":false},"assignees":[{"login":"egypt","id":287967,"avatar_url":"https://avatars2.githubusercontent.com/u/287967?v=3","gravatar_id":"","url":"https://api.github.com/users/egypt","html_url":"https://github.com/egypt","followers_url":"https://api.github.com/users/egypt/followers","following_url":"https://api.github.com/users/egypt/following{/other_user}","gists_url":"https://api.github.com/users/egypt/gists{/gist_id}","starred_url":"https://api.github.com/users/egypt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/egypt/subscriptions","organizations_url":"https://api.github.com/users/egypt/orgs","repos_url":"https://api.github.com/users/egypt/repos","events_url":"https://api.github.com/users/egypt/events{/privacy}","received_events_url":"https://api.github.com/users/egypt/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2017-05-25T03:56:25Z","updated_at":"2017-06-23T22:59:34Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/8452","html_url":"https://github.com/rapid7/metasploit-framework/pull/8452","diff_url":"https://github.com/rapid7/metasploit-framework/pull/8452.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/8452.patch"},"body":"This is a WIP for #8451.  I have not fully tested it and realize there may be important fingerprinting bits in other modules that may break because of this or the particulars of how this fingerprinting is *supposed* to work.  Posting here to get feedback and get assistance from others.\r\n\r\nThe idea here is to update `smb_fingerprint` to account for fingerprints first from native_os and then from native_lm, and merge them together, taking what comes from native_os in the event of conflicts.\r\n\r\nThis utilizes the recog native_lm fingerprints (https://github.com/rapid7/recog/blob/master/xml/smb_native_lm.xml) to attempt to obtain more complete/accurate fingerprints when necessary in relevant smb modules:\r\n\r\n```\r\nmodules/auxiliary/scanner/smb/smb_enumshares.rb\r\nmodules/auxiliary/scanner/smb/smb_uninit_cred.rb\r\nmodules/auxiliary/scanner/smb/smb_version.rb\r\nmodules/exploits/windows/brightstor/ca_arcserve_342.rb\r\nmodules/exploits/windows/smb/ms08_067_netapi.rb\r\n```\r\n\r\nThis will require updates to https://github.com/rapid7/metasploit_data_models/blob/fd3a94fdd6abfd528a44ad042fb7bd04c4c69308/lib/mdm/host/operating_system_normalization.rb#L253-L256"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/310790855","html_url":"https://github.com/rapid7/metasploit-framework/pull/8452#issuecomment-310790855","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8452","id":310790855,"user":{"login":"busterb","id":4108654,"avatar_url":"https://avatars0.githubusercontent.com/u/4108654?v=3","gravatar_id":"","url":"https://api.github.com/users/busterb","html_url":"https://github.com/busterb","followers_url":"https://api.github.com/users/busterb/followers","following_url":"https://api.github.com/users/busterb/following{/other_user}","gists_url":"https://api.github.com/users/busterb/gists{/gist_id}","starred_url":"https://api.github.com/users/busterb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/busterb/subscriptions","organizations_url":"https://api.github.com/users/busterb/orgs","repos_url":"https://api.github.com/users/busterb/repos","events_url":"https://api.github.com/users/busterb/events{/privacy}","received_events_url":"https://api.github.com/users/busterb/received_events","type":"User","site_admin":false},"created_at":"2017-06-23T22:59:34Z","updated_at":"2017-06-23T22:59:34Z","body":"Anything we should still be holding for here @jhart-r7 ?"}}
{"actor":{"display_login":"busterb"}}